EU AI Act + Open-Source Models: Llama, Mistral, Falcon

Main article: GPAI provider obligations — the provider obligations under Chapter V AI Act (Art. 53 to 55) in context.

Status of sources: The legal statements in this article are based on a review of sources as of 2 May 2026, updated as of 17 August 2026. The Digital Omnibus for the AI Act is in force as Regulation (EU) 2026/1744 since 27 July 2026 and is taken into account here.

1. The Art. 2(12) exemption

Open source with accessible weights is exempt from many obligations. BUT: the GPAI obligations under Art. 53 still apply.

How far the exemption reaches within the GPAI chapter is graded by Art. 53(1) AI Act itself, point by point — the breakdown for each obligation is set out in section 3.

As soon as you build such a model into an application, the object of assessment shifts. What is then assessed is the AI system under Art. 3 no. 1 AI Act — a machine-based system designed to operate with varying levels of autonomy and which infers from the input it receives how to generate outputs — together with its risk class under Art. 5, Art. 6 in conjunction with Annex III, and Art. 50.

One item of information is particularly important here: if the model is classified as a model with systemic risk under Art. 51, the relief under Art. 53(1) ends entirely (section 6). Which items of information you should collect for each model, and where to file them, is set out in section 2. The remaining conditions of Art. 2(12) are not covered by the source review for this article; they must be clarified case by case against the text of the Regulation.

2. What IS open source under the AI Act?

Model + weights + architecture freely accessible. In practice a distinction is drawn by licence type: Apache and MIT on the one hand, licences with usage or user-number restrictions on the other; the Llama licence belongs partly in the second group (restrictions on commercial use). Which type a specific model carries must be checked against the licence text for each model and version and recorded in the inventory.

For the obligations that follow, that classification is only half the answer. Whether a model falls within the GPAI chapter at all is decided by Art. 3 no. 63 AI Act: an AI model displaying significant generality, capable of competently performing a wide range of distinct tasks and that can be integrated into a variety of downstream systems or applications — excluding models used for research and development or prototyping activities before being placed on the market. The definition in Art. 3 no. 63 does not turn on the licence; the relief in Art. 53(1), by contrast, is tied to free and open-source models — which models those are must be clarified case by case against the text of the Regulation and is not covered by the source review for this article.

Within the second group of licences, the Llama licence draws the line at 700 million monthly active users. Practice recommendation for providers of such models (on the delimitation of roles, see section 4): treat the obligations under Art. 53(1)(a) and (b) as applicable as a precaution and give reasons for the classification in the inventory.

For the three models named in the title, the following table is a data-collection grid, not a result. The fields that are filled in reflect the state of the reviewed sources — the only model-specific items with evidence are the provider and the licence threshold for Llama, and the classification of Mistral AI as a GPAI provider. The open fields must be queried with the provider; none of the entries is a legal conclusion. An open field is not a no, but a question for the provider. You fill in the last column yourself with the source and the date of the answer:

Practice recommendation — a ready-to-copy enquiry to the provider, for each model and version:

1. Under which licence is version X provided, and does it contain usage or user-number restrictions?
2. Are the weights and the architecture publicly accessible?
3. Do you list the model as a model with systemic risk under Art. 51 AI Act, and how high was the cumulative amount of computation used for training, in FLOP?
4. Where is the summary of training data under Art. 53(1)(d) published?

File the answer together with the date it was given in the AI system inventory — along with the licence, the source of supply and the version, and in addition to the six fields an AI system inventory should keep in any event: name and provider, use case, role (provider, deployer or both), risk class, categories of data processed including special categories, and responsibility for oversight and escalation.

3. GPAI obligations apply nonetheless

Points (c) and (d) affect every GPAI provider, irrespective of whether the model was released as free and open source: the provider of Llama 3 (Meta) must comply with the copyright policy (Art. 53(1)(c)) and the summary of training data (Art. 53(1)(d)).

Art. 53(1) sets out four basic obligations. The column 'Free and open-source models' states, for each obligation, whether it applies to such models in a limited way or without limitation.

On the means of demonstrating compliance: until a harmonised standard is published, providers may rely on codes of practice within the meaning of Art. 56 under Art. 53(4) — for models with systemic risk via Art. 55(2). The GPAI Code of Practice is therefore a recognised means of demonstrating compliance, not a statutory presumption of conformity — that presumption arises only from compliance with a harmonised standard, in so far as it covers the obligations. Anyone who complies with neither a code of practice nor a harmonised standard must demonstrate adequate alternative means of compliance.

Practice recommendation for providers of free and open-source models: even where points (a) and (b) are owed only in a limited way, compliance is most easily demonstrated via a code of practice within the meaning of Art. 56 — otherwise the adequate alternative means must be documented independently; they are assessed by the Commission.

4. Self-hosting + fine-tuning

In the case of a substantial modification: you may become a provider yourself (Art. 25). Risk: all provider obligations.

Under Art. 25 a deployer moves into the provider role if it substantially modifies the purpose or functionality, or places the system on the market under its own name. In practice, provider status arises above all in three constellations: training your own model, a substantial fine-tuning modification — for example a medical language model based on an open-source model — or a wrapper with white-label branding and your own marketing. A custom GPT on a hosted platform, or a wrapper without your own marketing, does not give rise to it.

The difference is considerable. As the provider of a high-risk system you bear, among other things, risk management (Art. 9), data governance (Art. 10), technical documentation under Annex IV (Art. 11), logging (Art. 12), human oversight (Art. 14), accuracy, robustness and cybersecurity (Art. 15), the conformity assessment (Art. 43) and registration in the EU database (Art. 49(1), for all Annex III systems except no. 2) — for Annex III systems from 2 December 2027, and for the regulated products under Annex I from 2 August 2028 (Art. 113(3)(c) AI Act as amended by Regulation (EU) 2026/1744, in force since 27 July 2026; section 8). Practice recommendation: decide and document the role for each model before you begin fine-tuning — not afterwards.

5. Recommendation for SMEs

Self-hosting only where highly sensitive data and technical expertise are involved. Otherwise: use a GPAI provider wrapper (e.g. Aleph Alpha, Mistral La Plateforme). The weighing-up itself is a practice recommendation, not a legal consequence; the provisions named in the table apply irrespective of the decision for or against self-hosting. The providers named above are examples from the first version of this article, not a selection recommendation.

Irrespective of the operating model, two data protection requirements remain: every processing operation needs a legal basis under Art. 6(1) GDPR. And where the use is likely to result in a high risk to the rights and freedoms of natural persons — in particular where new technologies are used — a data protection impact assessment under Art. 35(1) GDPR must be carried out beforehand. On the fine ranges of both regimes, see section 9.

6. Systemic risk: when the relief ends

The relief for free and open-source models ends as soon as the model is classified as a GPAI model with systemic risk — points (a) and (b) then apply without limitation, and Art. 55 is added.

Classification follows Art. 51(1) where the model has high impact capabilities — assessed on the basis of appropriate technical tools, indicators and benchmarks — or where the Commission so decides on the basis of the criteria in Annex XIII. Under Art. 51(2), such capabilities are presumed where the cumulative amount of computation used for training exceeds 10²⁵ floating point operations.

Three steps make the threshold workable (practice recommendation): first, ask the provider for the training computation of the base model and record it in the inventory — the technical documentation under Annex XI lists the training effort, but applies only in a limited way to free and open-source models below the systemic-risk threshold. Second, log your own fine-tuning effort as well: Art. 51(2) turns on the cumulative amount of computation used for training; how your own post-training effort is to be taken into account is not covered by the source review for this article. Third, keep in mind that classification can also take place without the threshold, by decision of the Commission on the basis of the criteria in Annex XIII — the threshold is a presumption, not a ceiling.

You cannot verify this third route yourself; the classification is made by the Commission. Practice recommendation: when sourcing or fine-tuning an open-source model, agree an obligation on the provider to notify you of any change in the classification under Art. 51, and keep the classification for each model in the inventory together with the date queried; if it changes, the scope of obligations described in the first paragraph of this section applies immediately.

For Llama, Mistral and Falcon there is no reviewed information on classification under Art. 51; the corresponding column of the table in section 2 remains open for all three and must be queried with the respective provider.

The additional obligations under Art. 55(1) AI Act are four in number: model evaluation in accordance with standardised protocols, including adversarial testing (point (a)); assessment and mitigation of possible systemic risks at Union level (point (b)); recording, documenting and reporting without undue delay serious incidents to the EU AI Office and, as appropriate, to the competent national authorities (point (c)); and an adequate level of cybersecurity for the model and its physical infrastructure (point (d)).

7. What follows for internal company users

Anyone who uses an open-source model exclusively internally and without modification generally remains a deployer — and therefore bears a smaller but self-standing catalogue of obligations. The table names the obligations that affect such an internal user — from the AI Act in the deployer role, and from the GDPR as a Controller; the column 'Trigger' states what the provision in question is tied to.

Whether the rows on Art. 26 and Art. 27 apply is decided by the classification under Art. 6: as a safety component of a product under Annex I subject to third-party conformity assessment (paragraph 1), or via allocation to one of the eight areas of Annex III (paragraph 2) — biometrics, critical infrastructure, education, employment and workforce management, access to essential services, law enforcement, migration, asylum and border control, and administration of justice and democratic processes. The counter-exception in Art. 6(3) for systems without significant risk does not apply where the system performs profiling of natural persons; practice recommendation: interpret it narrowly and, in case of doubt, classify higher.

8. Deadlines: what applies when

For GPAI models the obligations did not change on 2 August 2026, but a year earlier; on 2 August 2026 only the Commission's power to impose fines was added. All entries in the table are dates of application under the AI Act, not practice recommendations.

For existing models, the transition period is the practically most important row. Practice recommendation: anyone using an open-source model that was placed on the market before 2 August 2025 should ask the provider how it demonstrates compliance by 2 August 2027 — the public summary of training data under Art. 53(1)(d) is the document that is easiest to check here, because it has to be published in any event.

9. Competence, fines, Germany and Austria

For the GPAI provider obligations it is not the national supervisory authority that is competent, but the Commission: for Chapter V it has exclusive supervisory and enforcement powers and entrusts implementation to the EU AI Office (Art. 88(1)). The national authorities — each Member State designates at least one notifying authority and at least one market surveillance authority, one of them as a single point of contact (Art. 70(1) and (2)) — are not competent for the provider obligations under Art. 53 and Art. 55.

Art. 99 grades the fines: up to EUR 35 million or 7 % of total worldwide annual turnover for the preceding financial year for infringements of the prohibited practices under Art. 5 (paragraph 3); up to EUR 15 million or 3 % for certain other infringements — among others provider obligations under Art. 16, deployer obligations under Art. 26 and transparency obligations under Art. 50 (paragraph 4); and up to EUR 7.5 million or 1 % for incorrect, incomplete or misleading information supplied to authorities (paragraph 5). For undertakings the higher amount applies; for SMEs and start-ups the lower one is applied under Art. 99(6). Against GPAI providers the Commission may impose fines of up to EUR 15 million or 3 % under Art. 101 since 2 August 2026. Art. 4 (AI literacy) does not fall under Art. 99(4); infringements of the training obligation have no separate EU fine range, and sanctions follow national law within the framework of Art. 99(1).

Alongside this, the GDPR fine regime runs with its own ranges: up to EUR 10 million or 2 % for infringements of Art. 28 and Art. 35 (Art. 83(4)) and up to EUR 20 million or 4 % for infringements of the processing principles and legal bases in Art. 5, 6, 7 and 9 (Art. 83(5)) — whichever amount is higher.

The AI Act applies directly and with identical wording in Germany and Austria; only implementation and authority structures (Art. 70) and the sanctions regime within the framework of Art. 99(1) are regulated nationally. In Germany, the market surveillance authority has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026 (§ 2(1) German AI Market Surveillance and Innovation Promotion Act (KI-MIG)), in so far as sectoral authorities — such as BaFin — are not competent; it is at the same time the single point of contact under Art. 70(2) AI Act (§ 6(1) KI-MIG). As at the date of this article (17 August 2026), Austria has not designated a market surveillance authority under Art. 70 AI Act; the RTR's AI service desk is an information and advisory body without supervisory powers. Further divergences arise in the accompanying law: for data protection, in Germany the authorities competent under Land law supervise non-public bodies and the Federal Commissioner for Data Protection (BfDI) supervises federal public bodies, while in Austria it is the Austrian Data Protection Authority (Datenschutzbehörde).